Assuming your JSON is well formed and all fields are extracted, try putting your field name within single or double quotes index="xxx" source="E:\\path\\REST\\test*" metricId!=9011737 metricId!=9012116 | stats sum('metricValues{}.sum') as total by metricId *OR* index="xxx" source="E:\\path\\REST\\test*" metricId!=9011737 metricId!=9012116 | rename 'metricValues{}.sum' AS s | stats sum(s) as total by metricId ... View more

How much will it cost after the 6-month period is over? ... View more

Splunk certifications (themselves) through Admin is free. Architect certification costs some. ... View more